In this case the link in the email goes to http://illen-beauty.ru/wp-admin/3PAbHfSM5FEma from where it downloads a file 2014_11_rechnung_1_1_000309399002.zip containing a malicious executable 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe which at the moment is quite widely detected at VirusTotal with 22/56 engines coming up positive.

The Malwr report shows that the payload is hardened against analysis, but it does show an attempted connection to 109.123.78.10 (UK2.net, UK) which might be worth looking for.